How Slingshot APT Attack Works

Slingshot APT attack very powerful creation by its authors and it developed with very sophisticated techniques to compromise the victims through a Windows exploit or compromised Mikrotik routers.

Initially victims runs the Winbox Loader software that downloads some DLLs by connecting to the router from routers file system which is already compromised and it contains malicious embedded code.

One of the DLL called “ipv4.dll” which is used to download other malicious components and run it into the users system.

According to kaspersky researchers, To run its code in kernel mode in the most recent versions of operating systems, that have Driver Signature Enforcement, Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities. .

later Slingshot will load a malicious modules in both kernel mode(Cahnadr) and user mode(GollumApp) and these module will play a major role to performing an information gathering operation and exfiltrate the sensitive data.

Slingshot Also evade the security system and avoid detection by encrypting all strings and using a number of Anti-bug techniques.

After the complete infection, slingshot will collect the sensitive information such as screenshots, keyboard data, USB connections.

Since it have a kernel level access, slingsgot will collect all the relevant information it need such as credit card numbers, password hashes, social security account numbers etc.

Researchers haven’t seen Slingshot exploit any zero-days, but that doesn’t mean that it doesn’t – that part of a story is still unclear for us. But it does exploit known vulnerabilities in drivers to pass executable code into kernel mode. Kaspersky said.Router

Subscribe to PHI via Email

Enter your email address to subscribe to PHI and receive notifications of new posts by email.

Join 3,288 other subscribers

Email Address

PROFESSIONAL HACKERS INDIA

We are proud to offer premier information security updates, IT updates, Core Tools And Techniques across the globe. Our mission is to make the internet more secure, more trendy, more aware and more reliable.